How Rodney Rocha Thinks About the Burden of Proof in Risk Decisions

Episode 7 of the Headline Podcast was published on October 9, 2025, with Rodney Rocha, the retired NASA chief engineer who served on the Columbia debris assessment team. His argument changes how leaders should frame uncertainty because the first question is not whether work is safe enough, but who must prove what before the decision is made.

That distinction matters in every operation where evidence is incomplete, production pressure is visible, and a familiar assumption can make an unusual exposure appear ordinary.

The burden of proof in a safety decision is the standard of evidence required before work is allowed to continue. When leaders ask teams to prove that a condition is unsafe, uncertainty favors continuation. When leaders ask for evidence that the work is safe enough for the stated exposure, uncertainty becomes a reason to pause, investigate, and assign a decision owner.

Why the burden of proof changes the risk decision

Most operating systems describe risk assessment as a technical exercise, yet the decisive moment often arrives earlier. Someone decides whether the available evidence is sufficient, whether the remaining uncertainty is tolerable, and whether the person raising the concern must keep arguing until the work is stopped.

Rocha described this problem through the Columbia experience, where reasonable assumptions helped normalize uncertainty that should have remained visible. The lesson is not that engineers lacked competence. It is that a competent group can still make a weak decision when its evidence threshold quietly favors continued operation.

Andreza Araujo's work across more than 250 cultural transformation projects supports the same practical distinction. A mature safety culture is not demonstrated by the existence of a risk form. It is demonstrated by the quality of the decision that follows when the form cannot resolve the uncertainty.

Leaders should therefore ask 2 questions before debating the control. What evidence would be enough to authorize the work, and who has the authority to stop it while that evidence is gathered? If neither answer is explicit, the organization has already placed the burden on the person closest to the exposure.

Rodney Rocha's central argument is about uncertainty

Rocha said on Headline Podcast, “Our profession's culture is to show it's safe enough to operate, you don't go the other way around and demand we prove it's unsafe, especially when we have hardly any information.” The quote identifies a decision bias that can sit inside highly respected technical systems.

Under the first model, the task continues unless someone can establish danger with enough certainty to overcome the schedule, cost, or hierarchy behind the decision. Under the second model, the task remains conditional until the evidence supports the intended operation. Both models use risk language, but they distribute responsibility in opposite directions.

The difference becomes visible in 3 situations. A maintenance team cannot verify an isolation point. A design review has only one plausible explanation for an abnormal signal. A supervisor hears a credible concern but cannot obtain a second inspection before the shift ends. In each case, the question is not whether the worker has proved a disaster will occur. The question is whether the current evidence supports the work that leaders want to authorize.

That is why the episode belongs in risk management rather than only in psychological safety. A person may be permitted to speak, yet still carry the full burden of proving that uncertainty is dangerous. The voice exists, but the decision system has not changed.

Reasonable assumptions can conceal deep uncertainty

Assumptions are necessary because no operation has perfect information. They become dangerous when a reasonable assumption is treated as a verified fact after the work, equipment, environment, or mission has changed.

In practice, an assumption usually enters through one of 4 routes. A previous inspection found no defect. A design calculation covered a similar configuration. A team has completed the task many times. A schedule makes further checking feel disproportionate. None of those statements proves that the present condition is unchanged.

James Reason's work on active and latent failures offers a useful safeguard. The visible error is often the final expression of earlier decisions about design, maintenance, communication, staffing, or review. When an assumption fails, a strong investigation preserves the path that made the assumption appear acceptable instead of treating the final operator as the whole explanation.

A decision log should record the assumption, the evidence supporting it, the evidence that would disconfirm it, and the person accountable for checking it. That creates a 4-part trail that can be reviewed before the next authorization, rather than reconstructed after an event has already occurred.

What the status quo does differently

Risk systems often look rigorous because they contain forms, approval levels, and technical language. Their real quality depends on what happens when information is missing or contradictory. The comparison below shows how the burden of proof changes the behavior of the system.

The second model does not demand zero uncertainty. It demands that leaders define the uncertainty they are accepting and name the person who owns that acceptance. That is a more honest standard because every high-risk decision contains limits, even when the paperwork looks complete.

Warnings weaken as they climb the hierarchy

Rocha also said, “If you lose people to fear and intimidation, you've lost valuable information, the company has lost it.” In a hierarchy, information can disappear without anyone intentionally suppressing it. A technician describes a condition, a supervisor shortens the description, a manager translates it into schedule language, and an executive receives only the conclusion.

The first control is to preserve the original concern. A decision owner should be able to read what was observed, where it was observed, when it was observed, and what uncertainty the person believed remained. Summaries can be useful, but they should not replace the source message when the decision involves serious harm.

The second control is a direct route for technical dissent. The route should identify an alternate reviewer, a response time, and the condition that triggers escalation. A route without those 3 fields is an aspiration rather than a control.

Andreza Araujo's book The Illusion of Conformity describes the difference between formal agreement and operating reality. The hierarchy may appear aligned because every level repeats the same conclusion, although the conclusion can become less accurate each time the original uncertainty is removed from the message.

How leaders can reset the evidence threshold

A leader does not need a new platform to change this pattern. The reset can begin with a 5-question review attached to the next high-consequence decision.

1. What condition, signal, or observation started the concern?
2. Which assumption allows the work to continue?
3. What evidence would disconfirm that assumption?
4. Who owns the decision to authorize, restrict, or stop the work?
5. When will the evidence and decision be reviewed again?

The questions work because they separate evidence from reassurance. “We have done this before” is context, not verification. “No one has reported a problem” is an observation about reporting, not proof that the control is effective. “The procedure permits it” confirms a document, not the condition at the point of work.

Use the review for 30 days across a small sample of decisions, then examine whether the same assumptions recur. The goal is not to produce 30 more records. The goal is to find the assumptions that repeatedly transfer uncertainty to the frontline and give their owners enough authority to remove it.

When the review identifies a missing inspection, an ambiguous limit, or a design question, the response should match the exposure. A minor clarification may need a documented owner and date. A life-critical uncertainty may require a stop, a second technical opinion, or a temporary restriction until the evidence changes.

Recommendation

Adopt a prove-it-safe-enough rule for decisions involving incomplete evidence, changing conditions, or credible technical dissent. Do not ask the person closest to the hazard to prove that failure is inevitable. Ask the decision owner to show that the evidence, controls, and operating limits support the work that is about to begin.

Start with 1 decision log, 2 review questions, and 3 escalation routes for the next 30 days. Track whether the original concern survives the hierarchy, whether the assumption is tested, and whether the final owner returns with a visible decision. Those 3 signals tell leaders more about risk governance than a completed form alone.

Rodney Rocha's Episode 7 conversation is valuable because it links technical judgment with organizational courage. Listen to the full conversation with Rodney Rocha on Headline Podcast, then explore more Headline safety conversations and Andreza Araujo's work at andrezaaraujo.com.